All language subtitles for 32 - EC2 Instance Migration using AMIs English

So very quick lecture, but if you wanted

to migrate an EC2 instance from one AZ to another,

well the way you would do it is using an AMI.

So, in this example, we want to migrate our EC2 instance

from us-east-1a to us-east-1b, in which case, first

we take an AMI from our EC2 instance and then restore

that AMI into a new EC2 instance, in a different AZ

which by default will have the same data

and the same file system and the same applications

because the AMI was taken from the original one.

So, that's it super simple to see, but good to know.

And if you want to see this, well, the AMI here

my instance is in eu-central-1c, okay?

And an image was taken from it.

And so what I can do is

that I can launch an image from this AMI module to micro

and then here I'm able to select a specific AZ

so, a specific subnet, and it could be for example

this one to have it in eu-central-1b

and then I would be good to go.

So, let's say for this lecture, I hope you liked it

and I will see you in the next lecture.

Okay, so now let's talk about cross account AMI sharing.

That means that you're sharing your AMI

with another AWS account.

In this case, when you share an AMI

it does not affect the ownership of the AMI,

you still have it, okay?

And you can share an AMI for in two cases.

Number one, if the volume is unencrypted

and that means you can share it with another account

or even share the AMI publicly, or if it's encrypted

it has to be encrypted with your own customer managed key

and we'll see the process for that as well.

If you are sharing the, what I mean is

that if you're sharing the AMI with an encrypted volume

that means that you need to share any key that is attached

to that volume as well

that was used to encrypt and decrypt that volume

otherwise the targeted account cannot use your volume.

So, let's take an example, a simple one.

We have account A

and this is an unencrypted AMI in your source accounts

and you're just going to share it with account B.

And then the account B can launch directly

an EC2 instance from that source AMI, very simple.

Now, if you add KMS encryption

we have the same use case, but this time your AMI

is actually encrypted with your CMK-A, okay?

And what you're going to do is that you're going to share

this AMI with your account B

but also you're going to share the KMS key.

Okay, your CMK.

And you're going to give permissions to the target accounts

to describe the key to decrypt to re-encrypt and so on.

And this will allow the target accounts

to launch your custom AMI,

even though it was encrypted

with a key from your accounts, okay?

Next, you can have the cross account AMI copy.

So, you have sharing and copying.

If you copy an AMI that has been shared with your accounts

you are then the owner of the target AMI in your accounts.

That means that the owner of the source AMI must grant you

the read permissions for the storage that backs the AMI.

So, the EBS snapshots, so it's a bit more involved.

So, account B now has the permission to read

the EBS snapshots behind the AMI.

So, it can run a copy image, API call

which will copy the source AMI into its own accounts.

And in the process, for example

you can encrypt the snapshot if you wanted to

with your own keys.

And as we'll see in the next slide

if the shared AMI is an encrypted snapshot

the owner must share the encrypted key

or keys with you as well.

And you can encrypt the AMI with your own CMK while copying

So, let's have a look if we have KMS encryption

in this example.

So, we are sharing the underlying EBS snapshot

and we still give KMS key permissions

to the target accounts, okay?

And the target accounts can issue

a copy command to, for example, re-encrypt the EBS snapshot

by decrypting it using the CMK-A that was given access to

and re-encrypt it with CMK-B and its own accounts

which will give a custom AMI that will be owned

by the target account B

with its own encryption mechanism, okay?

So, that's it for how AMI copy and sharing works.

So, if you have an AMI, what you can do

as you can see is that

if this AMI was shared with you, you could copy that AMI

and this would let you get your own copy of the AMI,

regardless of the sharing options afterwards.

Or if you take that AMI itself

you can have a look at the permissions in here

and you can edit these permissions.

So, what you would do is action, edit AMI permissions.

And in here you have multiple options.

So, if your AMI was private

it could be encrypted or unencrypted

or if it was unencrypted, you could make it public, okay?

And you have people around the world that can use your AMI

so, be careful with that.

Also, if you, it was private and you want to share it

with specific accounts organizations or OUs

then you would allow here to add account ID's

and you enter the account ID's.

If you wanted to share with individual accounts

or if you wanted to share with an entire organization

or OUs then you would add the Org/ARN or the OU ARN, okay?

And finally, when you do a sharing

you can click here to add the create volume permission

to the associated snapshots

when creating account permissions.

And this would allow the other accounts

to use your AMI at will, okay?

So, that's it for this lecture.

I hope you liked it.

And I will see you in the next lecture.